Understanding Hong Kong’s Crypto Exchange Licensing Regime: Requirements and Implications

According to the Worldwide Crypto Readiness Report, Hong Kong remains the most “crypto-ready” location in 2025. Hong Kong’s competitive structure, large number of blockchain startups, 0% capital gains tax for individuals, and favorable crypto legislation are helping to secure its reputation as a global crypto hub.

Since 2023, crypto businesses operating in Hong Kong or actively marketing their services to Hong Kong investors have been required to obtain licenses from the territory’s Securities and Futures Commission (SFC). This requirement arises from the Anti-Money Laundering and Counter Terrorist Financing Ordinance (AMLO), which introduced a major update to Hong Kong’s licensing regime for virtual asset service providers (VASPs). 

This regime aligns with international AML/CFT standards, including the FATF’s Travel Rule. It ensures AML/CFT compliance, protects investors, and builds the regulatory structure for Hong Kong’s future growth in the virtual assets industry. 

With a 250% increase in blockchain-related business in Hong Kong’s fintech sector since 2022, virtual assets have become a significant segment in the territory.

So, how can VASPs stay compliant, and how are the recent changes impacting the virtual assets landscape?

Licensing regime requirements

• The SFC requires all Virtual Asset Trading Platforms (VATPs) operating in Hong Kong or actively marketing their services to Hong Kong investors to obtain a license under the AMLO and Securities and Futures Ordinance (SFO)
• All VATPs have required a license to operate in or offer services to Hong Kong since June 1, 2023
• The company must be either incorporated in Hong Kong or registered as an overseas company with the Companies Registry of Hong Kong
• VATPs can only list high-liquidity tokens pre-approved by the SFC
• VATPs must appoint responsible officers that the SFC considers “fit and proper”
• VATPs must have sufficient paid-up share capital and liquid capital
• VATPs must file an Annual Return with the Companies Registry
• Licensees must follow strict AML and know-your-customer (KYC) procedures, including risk management, regular audits, transactions monitoring, sanctions compliance, and adherence to the Travel Rule
• VATPs are required to have strong custodial measures to safeguard user assets
• There is no capital gains tax on virtual assets, but those who trade on a regular basis may need to pay an income tax if it is considered income.

Industry impacts

This crypto exchange licensing regime has already led to increases in staff cost budgets, and is likely to have a range of significant impacts on Hong Kong. First and foremost, it could cement Hong Kong as a key player in crypto, both globally and in the APAC region, while boosting trust in its booming crypto sector.

This means investors may place greater trust in crypto exchanges in the territory, which could encourage more traditional financial institutions in Hong Kong to explore virtual asset investments. 

More interest from more players could then bring about an expansion of crypto services and products on offer. Notable success in Hong Kong may also encourage other jurisdictions in the region and around the world to effectively regulate virtual assets.

However, offering only SFC-approved tokens could prompt some investors to seek out unapproved assets or invest in a different region altogether. 

It’s also possible that increased costs and barriers associated with licensing regime compliance could lead to large platforms consolidating the market

Suggested read: What Is Crypto KYC and Why Do Exchanges Need It in 2025?

Hong Kong’s regulatory framework

Hong Kong’s updated Anti-Money Laundering Ordinance aligns with FATF Recommendation 15, according to which VASPs fall under AML and CFT regulations, with the requirement to obtain a license from the SFC. 

Under the new regime, centralized virtual asset trading platforms operating in Hong Kong need to apply to the SFC for a license under the Securities and Futures Ordinance (Cap 571) (SFO) and/or the AMLO (Dual Licence Arrangement).

The SFC has issued a series of guidelines to highlight the information necessary for license applicants and provide guidance on the new regulatory requirements. This includes the:

• Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers), which among other things, contains a chapter on virtual assets regulation. It provides guidance on money laundering risks, related regulatory requirements, and standards for addressing risk. These include risk factors that should be taken into consideration when conducting risk assessments, virtual asset-specific requirements in conducting Customer Due Diligence and ongoing monitoring, and requirements in relation to virtual asset transfers, third-party deposits, and payments.
• Guidelines for Virtual Asset Trading Platform Operators, which apply to all Platform Operators (whether they are licensed under the SFO and/or the AMLO) and provide clarification on standards and requirements expected of VA Platforms on investor protection requirements, safe custody of assets, segregation of client assets, avoidance of conflicts of interest, and cybersecurity. 
• Prevention of Money Laundering and Terrorist Financing Guideline issued by the Securities and Futures Commission for Associated Entities of Licensed Corporations and SFC-licensed Virtual Asset Service Providers, which sets out relevant anti-money laundering and counter-financing of terrorism (AML/CFT) statutory and regulatory requirements, and the AML/CFT standards which licensed corporations (LCs) and VASPs licensed by the SFC under the AMLO (SFC-licensed VAS Providers) should meet in order to comply with the statutory requirements under the AMLO and the SFO. This Guideline is intended for use by associated entities (AEs) that are not authorized financial institutions and their officers and staff.
• FAQs on licensing matters and conduct-related matters.

Licensing Handbook for Virtual Asset Trading Platform Operators, which sets out detailed procedures on how to apply for a license as well as the relevant ongoing notifications and other applications required of them after obtaining a license.

Who’s affected?

According to the licensing handbook, the following activities require a license: Type 1 (dealing in securities) and Type 7 (providing automated trading services). Both of these are regulated activities under section 116 of the SFO.

Regulated activities also include providing a virtual assets service under section 53ZRK of the AMLO, namely operating a virtual assets exchange, that is to say, providing services through means of electronic facilities. In short, corporations need a license to carry out the above activities in Hong Kong. Corporations also need a license if marketing regulated services to Hong Kong, independently or via an intermediary, even if using an individual. At the time of writing, ten virtual asset trading platforms have been licensed in Hong Kong’s growing market in accordance with this regulatory framework, with more being considered.

Who are the regulators?

One of the main regulators in Hong Kong is the Securities and Futures Commission (SFC), which derives its investigative, remedial, and disciplinary powers from the Securities and Futures Ordinance (SFO) and subsidiary legislation. The organization sets and enforces regulations on different industries, investigates suspicious cases, and provides licenses.

Another important organization is the Hong Kong Monetary Authority (HKMA)—Hong Kong’s central banking institution. Together with the SFC, the HKMA has published regulatory approaches to Virtual Assets and Virtual Asset Service Providers. The SFC and the HKMA have jointly issued a set of updated guidelines for SFC-regulated entities engaging in virtual asset-related activities in Hong Kong.

How to get licensed

Under the updated regime, crypto businesses must obtain a license from the Securities and Futures Commission, 

In line with the AMLO, here’s what the applicant should do to get licensed in Hong Kong:

• intend to provide services in the Hong Kong market
• pass a ‘fit and proper’ test that involves criminal background checks, AML/CFT performance history, financial standing, educational or other qualifications, reputation, experience, character, reliability, and financial integrity of the person, etc (as specified in Section 53ZRJ of the Ordinance)
• be joined by at least two persons (determined to be fit and proper for the business of providing a VA service) applying to be Responsible Officers  (particular requirements for Officers are specified in the Ordinance)
• lodge for approval of premises to be used for keeping records or documents required under the Ordinance

The following persons are fit and proper person to be associated with the business of providing the VA service:

• each director of the applicant (the company applying for the license)
• the ultimate owner (if any)

According to the AMLO, the SFC may impose any conditions on a granted license, including those relating to risk management, AML/CFT, financial resources, cybersecurity, and other conditions, as specified in the details of Section 53 ZRK of the Ordinance. In June 2023, the SFC published the guidelines, as specified above, in relation to licensing requirements. 

The application must be submitted to the Commission in the specified manner and accompanied by the prescribed fee.

Regulatory requirements for licensed businesses

The main regulations that companies need to follow are the AML Ordinance and the Guideline on Anti-Money Laundering and CounterFinancing of Terrorism. Under the Ordinance and Guidelines, crypto businesses must follow regulatory requirements including:

• Introducing AML/CTF measures:
  • Carrying out Customer Due Diligence (CDD), Simplified Due Diligence and Enhanced Due Diligence (where applicable) 
  • Carrying out transaction monitoring 
  • Implementing record-keeping
  • Screening clients against national and international sanctions and watchlists, as well as screening clients for PEP status
  • Complying with Travel Rule requirements
• Appointing an eligible auditor within 1 month after getting a licensed provider and within 7 business days after making an appointment notifying the Commission, by written notice, of the name and address of the auditor

A licensed provider must, within one month after it becomes licensed, notify the SFC, by written notice, of the date on which its financial year ends. An auditable entity must also prepare financial statements and other documents for prescribed periods and submit them together with a report of the auditor to the Commission not later than 4 months after the end of the financial year to which they relate.

A licensed person must submit an annual return and pay a prescribed fee to the commission within 1 month after each anniversary of the date of grant of the license (or by another date approved by the Commission). The person must notify the Commission in writing of any change in information that the licensed person or their ultimate owner has provided under the requirements of the Ordinance, including intended cessation of business, intention to change the address at which it proposes to provide any VA service, etc.

More detailed information regarding the requirements may be found in the Ordinance.

Travel Rule

Travel Rule obligations came into force in Hong Kong on June 1, 2023. A virtual asset transfer is a transaction carried out:

• By an institution (ordering institution) on behalf of an originator by transferring any virtual assets; and
• With a view to making the virtual assets available:
  • To that person or another person (recipient)
  • At an institution (beneficiary institution), which may be the ordering institution or another institution, whether or not one or more other institutions (intermediary institutions) participate in the completion of the transfer of the virtual assets.

For a virtual asset transfers over 8,000 HKD, the following data should be transferred to beneficiary VASP:

1. The originator’s name
2. The number of the originator’s account maintained with the financial institution and from which the virtual assets are transferred or, in the absence of such an account, a unique reference number assigned to the virtual asset transfer by the financial institution
3. The originator’s address, the originator’s customer identification number or identification document number, or, if the originator is an individual, the originator’s date and place of birth
4. The recipient’s name 
5. The number of the recipient’s account maintained with the beneficiary institution and to which the virtual assets are transferred or, in the absence of such an account, a unique reference number assigned to the virtual asset transfer by the beneficiary institution

For a virtual asset transfer involving virtual assets that amount to less than 8,000 HKD, the following data should be transferred to the beneficiary VASP:

• the information obtained and held under subsection (A), (B), (D), and (E) in relation to the transfer.

An ordering institution should not execute a virtual asset transfer when it cannot ensure that the required information can be submitted to a beneficiary institution or, where applicable, an intermediary institution in a secure manner. To ensure that the required information is submitted in a secure manner, an ordering institution should undertake VA transfer counterparty due diligence measures and take other appropriate measures and controls as specified in the Guideline.

To learn more about the Travel Rule in Hong Kong, check out our Help Desk with all the necessary information.

Sanctions

The Ordinance determined a wide range of offenses. Here’s a breakdown of some of the sanctions businesses can face (for the exact list, please see the Ordinance):

Operation without a license: businesses can be fined as much as 5,000,000 HKD (643,000 USD), while senior management can face imprisonment for up to seven years, and, in the case of a continuing offense, a further fine of 100,000 HKD (12,900 USD) for every day during which the offense continues. The same will apply when an unlicensed person actively markets a VA service they provide outside Hong Kong to the Hong Kong public.

Violation of AML rules: In case of non-compliance with the statutory AML/CTF requirements, the licensed VASP and its responsible officers are liable to a fine of 1,000,000 HKD (129,000 USD) and to imprisonment for two years if convicted on indictment. They may also be subject to a range of disciplinary sanctions, including suspension or revocation of licenses, reprimand, an order to take remedial action, and a pecuniary penalty (not exceeding 10,000,000 HKD ((1,286,000 USD)), or three times the amount of the profit gained or loss avoided, whichever is the greater) for misconduct such as contravening the AML/CTF or other regulatory requirements.

Provision of false, deceptive, or misleading statements about a business’s compliance status when filing a license application: A fine of 1,000,000 HKD (129,000 USD) and imprisonment for up to two years—on summary conviction, a fine at level 6 and imprisonment for 1 year.

Offense involving fraudulent or deceptive devices in VA transactions: A fine of 10,000,000 HKD (1,279,000 USD) and imprisonment for 10 years; or on summary conviction, a fine of 1,000,000 HKD (129,000 USD) and imprisonment for 3 years.

Fraudulently or recklessly inducing others to invest in virtual assets: A fine of 1,000,000 HKD (129,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine at level 6 and imprisonment for 6 months.

Offenses to destroy, conceal, or alter accounts, records, or documents: A fine of 1,000,000 HKD (129,000 USD) and imprisonment for 7 years—or, on summary conviction, a fine of 500,000 HKD (64,000 USD) and imprisonment for 1 year.

The SFC will be given broad powers to supervise AML/CTF and regulatory compliance by licensed VASPs. This will include powers to impose sanctions.

Next steps

With Hong Kong focusing on establishing one of the world’s most comprehensive regulatory frameworks for virtual assets, it continues to finetune its supervisory landscape in the years to come. To future-proof Hong Kong’s virtual assets market, the SFC announced its regulatory roadmap in February 2025: the ASPIRe Roadmap for Regulatory Assets.

Access:

1. Using regulatory clarity to streamline market entry
2. Establishing licensing regimes for trading in OTC markets and custody services
3. Attracting international platforms, order flows, and liquidity providers

Safeguards:

1. Optimizing compliance burdens without putting security at risk
2. Exploring dynamic security approaches
3. Enhancing frameworks for insurance and compensation
4. Clarifying investor onboarding and product categorization

Infrastructure:

1. Modernizing reporting, surveillance, and interagency collaboration
2. Considering solutions for efficient reporting
3. Using advanced tools to detect illicit activities
4. Strengthening local agency collaboration
5. Promoting cross-border collaboration

Relationships:

1. Using education, engagement, and transparency
2. Considering a framework for finfluencers to address channels of engagement for new investors
3. Cultivating a network of talent with sustainable communication

FAQ

• Is cryptocurrency regulated in Hong Kong?

  Yes, crypto is regulated under the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. Securities and futures contracts, as well as stored value facilities, are separately regulated under the Securities and Futures Ordinance (SFO) and other regulations.

• Who regulates crypto in Hong Kong?

  The Hong Kong Monetary Authority and the Securities and Futures Commission are the two main crypto regulators in Hong Kong.

• Does a Hong Kong crypto exchange need a license?

  Yes. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) amendment from 2023 introduced a licensing regime for crypto exchanges.